System, method and computer program product for enabling access to a resource of a multi-tenant on-demand database service utilizing a token

ABSTRACT

In accordance with embodiments, there are provided mechanisms and methods for enabling access to a resource of a multi-tenant on-demand database service utilizing a token. These mechanisms and methods for enabling access to a resource of a multi-tenant on-demand database service utilizing a token can be utilized to prevent identification of a user attempting to access the resource, and thus unwanted use of the user&#39;s identity.

CLAIM OF PRIORITY

This application is a continuation of U.S. application Ser. No.12/557,413, filed Sep. 10, 2009, which claims the benefit of U.S.Provisional Patent Application 61/096,556, filed Sep. 12, 2008, theentire contents of which are incorporated herein by reference.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent file or records, but otherwise reserves all copyrightrights whatsoever.

FIELD OF THE INVENTION

The current invention relates generally to resource accessibility, andmore particularly to enabling access to resources.

BACKGROUND

The subject matter discussed in the background section should not beassumed to be prior art merely as a result of its mention in thebackground section. Similarly, a problem mentioned in the backgroundsection or associated with the subject matter of the background sectionshould not be assumed to have been previously recognized in the priorart. The subject matter in the background section merely representsdifferent approaches, which in and of themselves may also be inventions.

In conventional database systems, users generally access resources in amanner whereby their identity is known. For example, a session cookiewhich identifies the user attempting to access the resource and inaddition to credentials of the user is customarily utilized and ninnytimes even required for accessing the resource. Unfortunately, makingthe identity of a user known when the user is attempting to access aresource allows for unwanted use of the user's identity. In someinstances, the unwanted use of the user's identity may include takingover the user's identify to perform malicious tasks, such as attacksincluding cross-site scripting attacks and cross-site request forgeryattacks.

BRIEF SUMMARY

In accordance with embodiments, there are provided mechanisms andmethods for enabling access to a resource of a multi-tenant on-demanddatabase service utilizing a token. These mechanisms and methods forenabling access to a resource of a multi-tenant on-demand databaseservice utilizing a token can be utilized to prevent identification of auser attempting to access the resource, and thus unwanted use of theuser's identity.

In an embodiment and by way of example, a method is provided forenabling access to a resource of a multi-tenant on-demand databaseservice utilizing a token. In use, a request to access a resource isreceived at a first domain of a multi-tenant on-demand database servicefrom a user. Additionally, a unique token is created for storage inassociation with a tenant identifier of a tenant of the multi-tenanton-demand database service and information to be utilized for accessingthe resource. Further, access to the resource is enabled utilizing theunique token, wherein the access to the resource is provided byredirecting the user to a second domain of the multi-tenant on-demanddatabase service.

While the present invention is described with reference to an embodimentin which techniques enabling access to a resource of a multi-tenanton-demand database service utilizing a token are implemented in anapplication server providing a front end for a multi-tenant databaseon-demand service, the present invention is not limited to multi-tenantdatabases or deployment on application servers. Embodiments may bepracticed using other database architectures, i.e., ORACLE®, DB2® andthe like without departing from the scope of the embodiments claimed.

Any of the above embodiments may be used alone or together with oneanother in any combination. Inventions encompassed within thisspecification may also include embodiments that are only partiallymentioned or alluded to or are not mentioned or alluded to at all inthis brief summary or in the abstract. Although various embodiments ofthe invention may have been motivated by various deficiencies with theprior art, which may be discussed or alluded to in one or more places inthe specification, the embodiments of the invention do not necessarilyaddress any of these deficiencies, In other words, different embodimentsof the invention may address different deficiencies that may bediscussed in the specification. Some embodiments may only partiallyaddress some deficiencies or just one deficiency that may be discussedin the specification, and some embodiments may not address any of thesedeficiencies.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a method for enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith one embodiment.

FIG. 2 shows a system for enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith another embodiment.

FIG. 3 shows a method for enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith yet another embodiment.

FIG. 4 shows a record for use in enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith another embodiment.

FIG. 5 illustrates a block diagram of an example of an environmentwherein an on-demand database service might be used.

FIG. 6 illustrates a block diagram of an embodiment of elements of FIG.5 and various possible interconnections between these elements.

DETAILED DESCRIPTION General Overview

Systems and methods are provided for enabling access to a resource of amulti-tenant on-demand database service utilizing a token.

To date, a user's identity has generally been made known when the useris attempting to access a resource. Unfortunately, this enables theuser's identity to be used for unwanted purposes (e.g. attacks, etc.)Thus, systems and methods are provided for enabling access to a resourceof a multi-tenant on-demand database service utilizing a token such thatidentification of the user's identity may be prevented for avoidingpotential unwanted use of the user's identity.

Next, mechanisms and methods for enabling access to a resource of amulti-tenant on-demand database service utilizing a token will bedescribed with reference to exemplary embodiments.

FIG. 1 shows a method 100 for enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith one embodiment. As shown in operation 102, a request to access aresource is received at a first domain of a multi-tenant on-demanddatabase service from a user, In the context of the present description,the multi-tenant on-demand database service may include any service thatrelies on a database system that is accessible over a network, in whichvarious elements of hardware and software of the database system may beshared by one or more tenants (e.g. customers, organizations, groups,users, etc.). For instance, a given application server maysimultaneously process requests for a great number of customers, and agiven database table may store rows for a potentially much greaternumber of customers. Various examples of such a multi-tenant on-demanddatabase service will be set forth in the context of differentembodiments that will be described during reference to subsequentfigures.

To this end, the first domain via which the request to access theresource is received may include a first server of the multi-tenanton-demand database service and/or any other device of the multi-tenanton-demand database service. Additionally, the request to access theresource may be received at the first domain via a network (e.g. theInternet, etc.). For example, a device of the user e.g. a browser of thedevice of the user) may transmit the request to access the resource(e.g. via a request message, etc.) to the first server over the network.

It should be noted that the request to access the resource may includeany request to download or otherwise receive, view, modify, etc. aresource. In various exemplary embodiments, the resource may include afile, an application (e.g. computer code), data, audio, video, etc.and/or any other type of content that may be made accessible to theuser. Optionally, the resource may be authored by the user or by anyother user, etc. Thus, for example, the request to access the resourcemay include a request to download content.

Additionally, a unique token is created for storage in association witha tenant identifier of a tenant of the multi-tenant on-demand databaseservice and information to be utilized for accessing the resource. Seeoperation 104. In one embodiment, the unique token may include arandomly generated identifier. To this end, for example, creating theunique token may include generated a random identifier. Of course,however, the unique token may include any type of token (e.g. value,etc.) that is unique (e.g. that is incapable of being maliciouslyforged, etc.).

As an option, the unique token may be automatically created. Forexample, the unique token may be automatically created on-demand inresponse to the receipt of the request to access the resource by thefirst domain. By creating unique tokens for use in accessing resources,as described below, in an on-demand manner, resources of themulti-tenant on-demand database service may be prevented from processingoverload as a result of creating multiple tokens for resources which arenot necessarily being attempted to be accessed.

Further, as noted above, the unique token is created for storage inassociation with a tenant identifier of a tenant of the multi-tenanton-demand database service and information to be utilized for accessingthe resource. In one embodiment, the unique token, the tenant identifierand the information to be utilized for accessing the resource may bestored in a record (e.g. a database record, a record in memory, etc,).Optionally, the record may be stored utilizing the multi-tenanton-demand database service (e.g. in memory of the multi-tenant on-demanddatabase service, etc.).

In another embodiment, the user may be associated with the tenant of themulti-tenant on-demand database service for which the tenant identifieris stored in association with the unique identifier. For example, thetenant may include a customer of the multi-tenant on-demand databaseservice in which the user is a member. Accordingly, the tenantidentifier may identify the tenant under which the user is attempting toaccess the resource.

In yet another embodiment, the information to be utilized for accessingthe resource may include any type of information (e.g. data structure,etc.) that is capable of being utilized to access the resource. Invarious exemplary embodiments, the information may include computer codeor a pointer to computer code, such that when executed the computer codeprovides the user with the access to the resource (e.g. by downloadingthe resource to the device of the user, etc.). In other exemplaryembodiments, the information may include a single value or a structuredset of commands capable of being parsed and executed for providing theuser with access to the resource.

Of course, it should be noted that the unique token may be stored inassociation with any other desired information relating to the requestto access the resource (e.g. utilizing the record, etc.). just by way ofexample, the unique token may further be stored in association with anidentifier of the user that requested the access to the resource, a teamidentifier of a team which the user is a member of, a context in whichthe user is operating (e.g. a source of the request, such as a webpage),etc.

Further, as shown in operation 106, access to the resource is enabledutilizing the unique token, wherein the access to the resource isprovided by redirecting the user to a second domain of the multi-tenanton-demand database service. As noted above, the first domain of themulti-tenant on-demand database service may include a first server ofthe multi-tenant on-demand database service. Accordingly, in oneembodiment, the second domain of the multi-tenant on-demand databaseservice may include a second server of the multi-tenant on-demanddatabase service. In this way, the user may request access to theresource from the first domain and access to the resource may beprovided, utilizing the token, by the second domain.

In one embodiment, the access to the resource may be enabled byproviding the user with the access to the resource (e.g. by downloadingthe resource to the device of the user, etc.). As another option, theaccess to the resource may be enabled utilizing the information to beused for accessing the resource that is stored in association with theunique token. For example, in the embodiment where the informationincludes computer code or a pointer to the computer code, the access tothe resource may be enabled by executing the computer code, Further, theaccess to the resource may be enabled utilizing the unique token suchthat access to the resource may only he allowed by virtue of the uniquetoken.

Just by way of example, enabling access to the resource utilizing theunique token may include only allowing the user to access the resourceif the unique token is verified. In one embodiment, the unique token maybe verified by determining that the unique token is stored (e.g. inassociation with the tenant identifier and the information to beutilized for accessing the resource). In another embodiment, the uniquetoken may include a time-to-live, such that the unique token may beverified by determining that the unique token as not expired. In yetanother embodiment, the unique token may be associated with a one-timeuse policy (e.g. for security purposes), such that the unique token maybe verified by determining that the unique token has not previously beenutilized for accessing the resource. To this end, if the unique token isnot verified, the access to the resource by the user may be prevented,blocked, etc.

Thus, as described above, a unique token may he created and stored basedon a user request to access a resource that is received at a firstdomain of the multi-tenant on-demand database service. The unique tokenmay be then be utilized for enabling access to the resource, where theaccess to the resource is provided using the second domain of themulti-tenant on-demand database service. In this way, the second domainmay provide the user with the access to the resource without theidentity of the user (e.g. the session identifier used by the user,etc.) necessarily being made know to the second domain, such that theidentity of the user may be prevented from being intercepted and used byanother entity for malicious purposes (e.g. for use in cross-sitescripting attacks, cross-site request forgery attacks, etc.).

FIG. 2 shows a system 200 for enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith another embodiments an option, the present system 200 may beimplemented in the context of the functionality of FIG. 1. Of course,however, the system 200 may be implemented in any desired environment.The aforementioned definitions may apply during the present description.

As shown, a user device 202 includes a browser 204 that is incommunication with a first domain of a multi-tenant on-demand databaseservice 206 and a second domain of the multi-tenant on-demand databaseservice 210 (e.g. via a network). The browser 204 of the user device 202may include a web browser, for example. In this way, the user device 202may utilize the browser 204 for accessing the first domain of themulti-tenant on-demand database service 206 and the second domain of themulti-tenant on-demand database service 210.

In use, the browser 204 of the user device 202 sends a request to thefirst domain of the multi-tenant on-demand database service 206 foraccessing a resource. The request may include a request message, forexample, indicating the resource to which access is requested, the typeof access to the resource that is requested, and an identifier of atenant of the multi-tenant on-demand database service that is associatedwith the user using the user device 202. Optionally, the user may beidentified based on login credentials used by the user to log into, andthus send the request to, the first domain of the multi-tenant on-demanddatabase service 206.

Upon receipt of the request from the browser 204 of the user device 202,the first domain of the multi-tenant on-demand database service 206creates a unique token. In one embodiment, the unique token may becreated by randomly generating an identifier. Further, the first domainof the multi-tenant on-demand database service 206 stores the uniquetoken in association with the identifier of the tenant and informationto be used for accessing the resource. For example, the information maybe generated based on the indication in the request of the resource towhich access is requested and the type of access to the resource that isrequested. As an option, the information to be used for accessing theresource may include computer code [e.g. written in extensible markuplanguage (XML), etc.] capable of being executed to provide to thebrowser 204 of the user device 202 the requested access to the resource.

As shown, the unique token and associated tenant identifier andinformation to be used for accessing the resource are stored in one of aplurality of records of the multi-tenant on-demand database service 208.The records of the multi-tenant on-demand database service 208 may beincluded in a database of the multi-tenant on-demand database service,random access memory of a server of the multi-tenant on-demand databaseservice, a file of the multi-tenant on-demand database service, etc.

Further, the unique token is forwarded from the first domain of themulti-tenant on-demand database service 206 to the browser 204 of theuser device 202, and the browser 204 is redirected to the second domainof the multi-tenant on-demand database service 210. For example, thebrowser 204 of the user device 202 may be instructed by the first domainof the multi-tenant on-demand database service 206 to transmit theunique token to the second domain of the multi-tenant on-demand databaseservice 210. Optionally, the first domain of the multi-tenant on-demanddatabase service 206 may indicate a uniform resource locator (URL) ofthe second domain of the multi-tenant on-demand database service 210 towhich the unique token is to be transmitted.

Accordingly, the browser 204 of the user device 202 transmits the uniquetoken to the second domain of the multi-tenant on-demand databaseservice 210 for accessing the resource. Upon receipt of the uniquetoken, the second domain of the multi-tenant on-demand database service210 verifies the unique token for determining whether to enable accessto the resource by the browser 204 of the user device 202.

In one embodiment, the second domain of the multi-tenant on-demanddatabase service 210 may verify the unique token by performing a look-upof the unique token in the multi-tenant on-demand database servicerecords 208. For example, if the unique token is found in themulti-tenant on-demand database service records 208, the access to theresource may be enabled by the second domain of the multi-tenanton-demand database service 210. In another embodiment, the second domainof the multi-tenant on-demand database service 210 may verify the uniquetoken by determining whether the unique token as expired (e.g. based ona time-to-live configured for the unique token). For example, if theunique token as not expired, the access to the resource may be enabledby the second domain of the multi-tenant on-demand database service 210.

In yet another embodiment, the second domain of the multi-tenanton-demand database service 210 may verify the unique token bydetermining whether the unique token has previously been used to accessthe resource, if the unique token is associated with a one-time usepolicy. Thus, if it is determined that the unique token has notpreviously been used to access the resource, the access to the resourcemay be enabled by the second domain of the multi-tenant on-demanddatabase service 210. It should be noted that in other embodiments, theunique token may be associated with a policy that allows a plurality(e.g. predefined number or unlimited number) of uses thereof.

Of course, it should be noted that the verification of the unique tokenmay include any combination of the above embodiments. Just by way ofexample, the access to the resource may be enabled by the second domainof the multi-tenant on-demand database service 210 only if the uniquetoken is stored in the multi-tenant on-demand database service records208, the time-to live for the unique token has not expired, and theone-time use of the unique token has not previously been consumed by aprior access to the resource utilizing the unique token.

If verification of the unique token by the second domain of themulti-tenant on-demand database service 210 fails (e.g. if the uniquetoken is not stored in the multi-tenant on-demand database servicerecords 208, the time-to-live for the unique token has expired, theone-time use of the unique token has previously been consumed by a prioraccess to the resource utilizing the unique token, etc.), the seconddomain of the multi-tenant on-demand database service 210 prevents thebrowser 204 of the user device 202, and thus the user of the user device202, from accessing the resource. Optionally, the second domain of themulti-tenant on-demand database service 210 may send an error message tothe browser 204 of the user device 202 indicating that access to theresource is denied.

If, however, the unique token is verified by the second domain of themulti-tenant on-demand database service 210, the second domain of themulti-tenant on-demand database service 210 enables the browser 204 ofthe user device 202 to access the resource. Thus, access to the resourcemay be provided to a user of the user device 202 in response to theverification of the unique token. In one embodiment, the second domainof the multi-tenant on-demand database service 210 may use theinformation to be used for accessing the resource that is stored in themulti-tenant on-demand database service records 208 for enabling (e.g.providing) the access to the resource. For example, the second domain ofthe multi-tenant on-demand database service 210 may use the unique tokento look-up such information, such that the information may be parsed andused to perform an action (e.g. execute computer code indicated by theinformation, etc.) providing the browser 204 of the user device 202 withthe resource. In one embodiment, the second domain of the multi-tenanton-demand database service 210 performs the action (providing thebrowser 204 of the user device 202 with the resource) in the context ofthe user device 202.

FIG. 3 shows a method 300 for enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith yet another embodiment. As an option, the method 300 may be carriedout in the context of the functionality of FIGS. 1-2. Of course,however, the method 300 may be carried out in any desired environment,Again, the aforementioned definitions may apply during the presentdescription.

As shown in decision 302, it is determined whether a request to access aresource is received at a first domain of a multi-tenant on-demanddatabase service from a user browser. In the context of the presentembodiment, the request may include any request to access a resourcethat is received from a browser of a user communicating with themulti-tenant on-demand database service via a tenant's account with themulti-tenant on-demand database service, Optionally, the determinationmay include determining whether a message has been received at the firstdomain of a multi-tenant on-demand database service requesting access toa resource of the multi-tenant on-demand database service.

If it is determined that a request to access a resource is not receivedat the first domain of the multi-tenant on-demand database service, themethod 300 continues to wait for such a request to be received at thefirst domain of the multi-tenant on-demand database service. If,however, it is determined that a request to access a resource isreceived at the first domain of the multi-tenant on-demand databaseservice, a unique token for the request is created. See operation 304.In one embodiment, the unique token may be created by the first domainof the multi-tenant on-demand database service.

Further, as shown in operation 306, the unique token is stored in arecord with an identifier of the tenant and with information to be usedfor accessing the resource, For example, the first domain of themulti-tenant on-demand database service may store the unique token, thetenant identifier and the information to be used for accessing theresource in the record.

Additionally, the unique token is sent to the user browser. Seeoperation 308. It is then determined in decision 310 whether the uniquetoken is received at a second domain of the multi-tenant on-demanddatabase service from the user browser. If it is determined that theunique token has not been received at the second domain of themulti-tenant on-demand database service, the method 300 continues towait for the unique token to be received at the second domain of themulti-tenant on-demand database service.

If, however, it is determined that the unique token has been received atthe second domain of the multi-tenant on-demand database service, it isdetermined whether the unique token can be verified. See decision 312.For example, it may be determined whether the unique token is stored inthe record, whether the unique token is expired, etc. If it isdetermined that the unique token cannot be verified, an error isreturned to the user browser, as shown in operation 314. Further, accessto the resource may be blocked. If it is determined that the uniquetoken is verified, the resource is provided to the user browser. Seeoperation 316.

FIG. 4 shows a record 400 for use in enabling access to a resource of amulti-tenant on-demand database service utilizing a token, in accordancewith another embodiment, As an option, the record 400 may be implementedin the context of the functionality of FIGS. 1-2. Of course, however,the record 400 may be implemented in any desired environment. Again, theaforementioned definitions may apply during the present description.

As shown, the record 400 stores a record identifier 402 for uniquelyidentifying the record. The record 400 also stores a user identifier404. The user identifier 404 may identify a user that has requestedaccess to a resource.

Further, the record 400 stores a tenant identifier 406. The tenantidentifier 406 may identify a tenant of a multi-tenant on-demanddatabase service under which the user is operating. For example, thetenant may have an account with the multi-tenant on-demand databaseservice, and the user may be utilizing such account for requesting theaccess to the resource.

As also shown, the record 400 stores a unique token 408. The uniquetoken 408 may include a randomly generated identifier that is specificto the requested access to the resource. For example, the unique token408 may be created in response to the requested access to the resource.

The record 400 further includes information 410 to be used for accessinga resource. As an option, the information 410 may be generated from therequest to access the resource, For example, the information 410 mayindicate the type of access requested and the resource to which theaccess is requested. As an option, the information 410 may includecomputer code or a pointer thereto which when executed provides the userwith the access to the resource.

System Overview

FIG. 5 illustrates a block diagram of an environment 510 wherein anon-demand database service might be used. As an option, any of thepreviously described embodiments of the foregoing figures may or may notbe implemented in the context of the environment 510. Environment 510may include user systems 512, network 514, system 516, processor system517, application platform 518, network interface 520, tenant datastorage 522, system data storage 524, program code 526, and processspace 528. In other embodiments, environment 510 may not have all of thecomponents listed and/or may have other elements instead of, or inaddition to, those listed above.

Environment 510 is an environment in which an on-demand database serviceexists, User system 512 may be any machine or system that is used by auser to access a database user system. For example, any of user systems512 can be a handheld computing device, a mobile phone, a laptopcomputer, a work station, and/or a network of computing devices. Asillustrated in FIG. 5 (and in more detail in FIG. 6) user systems 512might interact via a network with an on-demand database service, whichis system 516.

An on-demand database service, such as system 516, is a database systemthat is made available to outside users that do not need to necessarilybe concerned with building and/or maintaining the database system, butinstead may be available for their use when the users need the databasesystem (e.g., on the demand of the users). Some on-demand databaseservices may store information from one or more tenants stored intotables of a common database image to form a multi-tenant database system(MTS). Accordingly, “on-demand database service 516” and “system 516”will be used interchangeably herein. A database image may include one ormore database objects. A relational database management system (RDMS) orthe equivalent may execute storage and retrieval of information againstthe database object(s). Application platform 518 may be a framework thatallows the applications of system 516 to run, such as the hardwareand/or software, e.g., the operating system. In an embodiment, on-demanddatabase service 516 may include an application platform 518 thatenables creation, managing and executing one or more applicationsdeveloped by the provider of the on-demand database service, usersaccessing the on-demand database service via user systems 512, or thirdparty application developers accessing the on-demand database servicevia user systems 512.

The users of user systems 512 may differ in their respective capacities,and the capacity of a particular user system 512 might be entirelydetermined by permissions (permission levels) for the current user. Forexample, where a salesperson is using a particular user system 512 tointeract with system 516, that user system has the capacities allottedto that salesperson. However, while an administrator is using that usersystem to interact with system 516, that user system has the capacitiesallotted to that administrator. In systems with a hierarchical rolemodel, users at one permission level may have access to applications,data, and database information accessible by a lower, permission leveluser, but may not have access to certain applications, databaseinformation, and data accessible by a user at a higher permission level.Thus, different users will have different capabilities with regard toaccessing and modifying application and database information, dependingon a user's security or permission level.

Network 514 is any network or combination of networks of devices thatcommunicate with one another. For example, network 514 can be any one orany combination of a LAN (local area network), WAN (wide area network),telephone network, wireless network, point-to-point network, starnetwork, token ring network, hub network, or other appropriateconfiguration. As the most common type of computer network in currentuse is a TCP/IP (Transfer Control Protocol and Internet Protocol)network, such as the global internetwork of networks often referred toas the “Internet” with a capital “I,” that network will be used in manyof the examples herein. However, it should be understood that thenetworks that the present invention might use are not so limited,although TCP/IP is a frequently implemented protocol.

User systems 512 might communicate with system 516 using TCP/IP and, ata higher network level, use other common Internet protocols tocommunicate, such as HTTP, FTP, AFS, WAP, etc. In an example where HTTPis used, user system 512 might include an HTTP client commonly referredto as a “browser” for sending and receiving HTTP messages to and from anMIP server at system 516. Such an HTTP server might be implemented asthe sole network interface between system 516 and network 514, but othertechniques might be used as well or instead. In some implementations,the interface between system 516 and network 514 includes load sharingfunctionality, such as round-robin HTTP request distributors to balanceloads and distribute incoming HTTP requests evenly over a plurality ofservers. At least as for the users that are accessing that server, eachof the plurality of servers has access to the MTS' data; however, otheralternative configurations may be used instead.

In one embodiment, system 516, shown in FIG. 5, implements a web-basedcustomer relationship management (CRM) system. For example, in oneembodiment, system 516 includes application servers configured toimplement and execute CRM software applications as well as providerelated data, code, forms, webpages and other information to and fromuser systems 512 and to store to, and retrieve from, a database systemrelated data, objects, and Webpage content. With a multi-tenant system,data for multiple tenants may be stored in the same physical databaseobject, however, tenant data typically is arranged so that data of onetenant is kept logically separate from that of other tenants so that onetenant does not have access to another tenant's data, unless such datais expressly shared. In certain embodiments, system 516 implementsapplications other than, or in addition to, a CRM application. Forexample, system 516 may provide tenant access to multiple hosted(standard and custom) applications, including a CRM application. User(or third party developer) applications, which may or may not includeCRM, may be supported by the application platform 518, which managescreation, storage of the applications into one or more database objectsand executing of the applications in a virtual machine in the processspace of the system 516.

One arrangement for elements of system 516 is shown in FIG. 6, includinga network interface 520, application platform 518, tenant data storage522 for tenant data 523, system data storage 524 for system dataaccessible to system 516 and possibly multiple tenants, program code 526for implementing various functions of system 516, and a process space528 for executing MTS system processes and tenant-specific processes,such as running applications as part of an application hosting service.Additional processes that may execute on system 516 include databaseindexing processes.

Several elements in the system shown in FIG. 5 include conventional,well-known elements that are explained only briefly here. For example,each user system 512 could include a desktop personal computer,workstation, laptop, PDA, cell phone, or any wireless access protocol(WAP) enabled device or any other computing device capable ofinterfacing directly or indirectly to the Internet or other networkconnection. User system 512 typically runs an HTTP client, e.g., abrowsing program, such as Microsoft's Internet Explorer browser,Netscape's Navigator browser, Opera's browser, or a WAP-enabled browserin the case of a cell phone, PDA or other wireless device, or the like,allowing a user (e.g. subscriber of the multi-tenant database system) ofuser system 512 to access, process and view information, pages andapplications available to it from system 516 over network 514. Each usersystem 512 also typically includes one or more user interface devices,such as a keyboard, a mouse, trackball, touch pad, touch screen, pen orthe like, for interacting with a graphical user interface (GUI) providedby the browser on a display (e.g. a monitor screen, LCD display, etc.)in conjunction with pages, forms, applications and other informationprovided by system 516 or other systems or servers. For example, theuser interface device can be used to access data and applications hostedby system 516, and to perform searches on stored data, and otherwiseallow a user to interact with various GUI pages that may be presented toa user. As discussed above, embodiments are suitable for use with theInternet, which refers to a specific global internetwork of networks.However, it should be understood that other networks can be used insteadof the Internet, such as an intranet, an extranet, a virtual privatenetwork (VPN), a non-TCP/IP based network, any LAN or WAN or the like.

According to one embodiment, each user system 512 and all of itscomponents are operator configurable using applications, such as abrowser, including computer code run using a central processing unitsuch as an Intel Pentium® processor or the like. Similarly, system 516(and additional instances of an MTS, where more than one is present) andall of their components might be operator configurable usingapplication(s) including computer code to run using a central processingunit such as processor system 517 of FIG. 5, which may include an IntelPentium® processor or the like, and/or multiple processor units. Acomputer program product embodiment includes a machine-readable storagemedium (media) having instructions stored thereon/in which can be usedto program a computer to perform any of the processes of the embodimentsdescribed herein. Computer code for operating and configuring system 516to intercommunicate and to process webpages, applications and other dataand media content as described herein are preferably downloaded andstored on a hard disk, but the entire program code, or portions thereof,may also be stored in any other volatile or non-volatile memory mediumor device as is well known, such as a ROM or RAM, or provided on anymedia capable of storing program code, such as any type of rotatingmedia including floppy disks, optical discs, digital versatile disk(DVD), compact disk (CD), microdrive, and magneto-optical disks, andmagnetic or optical cards, nanosystems (including molecular memory ICs),or any type of media or device suitable for storing instructions and/ordata. Additionally, the entire program code, or portions thereof, may betransmitted and downloaded from a software source over a transmissionmedium, e.g., over the Internet, or from another server, as is wellknown, or transmitted over any other conventional network connection asis well known (e.g. extranet, VPN, LAN, etc.) using any communicationmedium and protocols (e.g. TCP/IP, HTTP, HTTPS, Ethernet, etc.) as arewell known. It will also be appreciated that computer code forimplementing embodiments of the present invention can be implemented inany programming language that can be executed on a client system and/orserver or server system such as, for example, C, C++, HTML, any othermarkup language, Java™, JavaScript, ActiveX, any other scriptinglanguage, such as VBScript, and many other programming languages as arewell known may be used. (Java™ is a trademark of Sun Microsystems,Inc.).

According to one embodiment, each system 516 is configured to providewebpages, forms, applications, data and media content to user (client)systems 512 to support the access by user systems 512 as tenants ofsystem 516. As such, system 516 provides security mechanisms to keepeach tenant's data separate unless the data is shared. If more than oneMTS is used, they may be located in close proximity to one another (e.g.in a server farm located in a single building or campus), or they may bedistributed at locations remote from one another (e.g. one or moreservers located in city A and one or more servers located in city B). Asused herein, each MTS could include one or more logically and/orphysically connected servers distributed locally or across one or moregeographic locations. Additionally, the term “server” is meant toinclude a computer system, including processing hardware and processspace(s), and an associated storage system and database application(e.g. OODBMS or RDBMS) as is well known in the art. It should also beunderstood that “server system” and “server” are often usedinterchangeably herein. Similarly, the database object described hereincan be implemented as single databases, a distributed database, acollection of distributed databases, a database with redundant online oroffline backups or other redundancies, etc., and might include adistributed database or storage network and associated processingintelligence.

FIG. 6 also illustrates environment 510. However, in FIG. 6 elements ofsystem 516 and various interconnections in an embodiment are furtherillustrated. FIG. 6 shows that user system 512 may include processorsystem 512A, memory system 512B, input system 512C, and output system512D. FIG. 6 shows network 514 and system 516. FIG. 6 also shows thatsystem 516 may include tenant data storage 522, tenant data 523, systemdata storage 524, system data 525, User Interface (UI) 630, ApplicationProgram interface (API) 632, PL/SOQL 634, save routines 636, applicationsetup mechanism 638, applications servers 600 ₁-600 _(N), system processspace 602, tenant process spaces 604, tenant management process space610, tenant storage area 612, user storage 614, and application metadata616. In other embodiments, environment 510 may not have the sameelements as those listed above and/or may have other elements insteadof, or in addition to, those listed above.

User system 512, network 514, system 516, tenant data storage 522, andsystem data storage 524 were discussed above in FIG. 5. Regarding usersystem 512, processor system 512A may be any combination of one or moreprocessors. Memory system 5128 may be any combination of one or morememory devices, short term, and/or long term memory. Input system 512Cmay be any combination of input devices, such as one or more keyboards,mice, trackballs, scanners, cameras, and/or interfaces to networks.Output system 512D may be any combination of output devices, such as oneor more monitors, printers, and/or interfaces to networks. As shown byFIG. 6, system 516 may include a network interface 520 (of FIG. 5)implemented as a set of HTTP application servers 600, an applicationplatform 518, tenant data storage 522, and system data storage 524. Alsoshown is system process space 602, including individual tenant processspaces 604 and a tenant management process space 610, Each applicationserver 600 may be configured to tenant data storage 522 and the tenantdata 523 therein, and system data storage 524 and the system data 525therein to serve requests of user systems 512. The tenant data 523 mightbe divided into individual tenant storage areas 612, which can be eithera physical arrangement and/or a logical arrangement of data. Within eachtenant storage area 612, user storage 614 and application metadata 616might be similarly allocated for each user. For example, a copy of auser's most recently used (MRU) items might be stored to user storage614. Similarly, a copy of MRU items for an entire organization that is atenant might be stored to tenant storage area 612. A 630 provides a userinterface and an API 632 provides an application programmer interface tosystem 516 resident processes to users and/or developers at user systems512. The tenant data and the system data may be stored in variousdatabases, such as one or more Oracle™ databases.

Application platform 518 includes an application setup mechanism 638that supports application developers' creation and management ofapplications, which may be saved as metadata into tenant data storage522 by save routines 636 for execution by subscribers as one or moretenant process spaces 604 managed by tenant management process 610 forexample. Invocations to such applications may be coded using PL/SOQL 634that provides a programming language style interface extension to API632. A detailed description of some PL/SOQL language embodiments isdiscussed in commonly owned U.S. Provisional Patent Application60/828,192 entitled, “PROGRAMMING LANGUAGE METHOD AND SYSTEM FOREXTENDING APIS TO EXECUTE IN CONJUNCTION WITH DATABASE APIS,” by CraigWeissman, filed Oct. 4, 2006, which is incorporated in its entiretyherein for all purposes. Invocations to applications may be detected byone or more system processes, which manage retrieving applicationmetadata 616 for the subscriber making the invocation and executing themetadata as an application in a virtual machine.

Each application server 600 may be communicably coupled to databasesystems, e.g., having access to system data 525 and tenant data 523, viaa different network connection. For example, one application server 600₁ might be coupled via the network 514 (e.g., the Internet), anotherapplication server 600 _(N−1) might be coupled via a direct networklink, and another application server 600 _(N) might be coupled by yet adifferent network connection. Transfer Control Protocol and InternetProtocol (TCP/IP) are typical protocols for communicating betweenapplication servers 600 and the database system. However, it will beapparent to one skilled in the art that other transport protocols may beused to optimize the system depending on the network interconnect used.

In certain embodiments, each application server 600 is configured tohandle requests for any user associated with any organization that is atenant. Because it is desirable to be able to add and remove applicationservers from the server pool at any time for any reason, there ispreferably no server affinity for a user and/or organization to aspecific application server 600, In one embodiment, therefore, aninterface system implementing aloud balancing function (e.g., an F5Big-IP load balancer) is communicably coupled between the applicationservers 600 and the user systems 512 to distribute requests to theapplication servers 600. In one embodiment, the load balancer uses aleast connections algorithm to route user requests to the applicationservers 600. Other examples of load balancing algorithms, such as roundrobin and observed response time, also can be used. For example, incertain embodiments, three consecutive requests from the same user couldhit three different application servers 600, and three requests fromdifferent users could hit the same application server 600. In thismanner, system 516 is multi-tenant, wherein system 516 handles storageof, and access to, different objects, data and applications acrossdisparate users and organizations.

As an example of storage, one tenant might be a company that employs asales force where each salesperson uses system 516 to manage their salesprocess. Thus, a user might maintain contact data, leads data, customerfollow-up data, performance data, goals and progress data, etc., allapplicable to that user's personal sales process (e.g., in tenant datastorage 522). In an example of a MTS arrangement, since all of the dataand the applications to access, view, modify, report, transmit,calculate, etc., can be maintained and accessed by a user system havingnothing more than network access, the user can manage his or her salesefforts and cycles from any of many different user systems, For example,if a salesperson is visiting a customer and the customer has Internetaccess in their lobby, the salesperson can obtain critical updates as tothat customer while waiting for the customer to arrive in the lobby.

While each user's data might be separate from other users' dataregardless of the employers of each user, some data might beorganization-wide data shared or accessible by a plurality of users orall of the users for a given organization that is a tenant. Thus, theremight be some data structures managed by system 516 that are allocatedat the tenant level while other data structures might be managed at theuser level. Because an MTS might support multiple tenants includingpossible competitors, the MIS should have security protocols that keepdata, applications, and application use separate. Also, because manytenants may opt for access to an MTS rather than maintain their ownsystem, redundancy, up-time, and backup are additional functions thatmay be implemented in the MTS. In addition to user-specific data andtenant-specific data, system 516 might also maintain system level datausable by multiple tenants or other data. Such system level data mightinclude industry reports, news, postings, and the like that are sharableamong tenants.

In certain embodiments, user systems 512 (which may be client systems)communicate with application servers 600 to request and updatesystem-level and tenant-level data from system 516 that may requiresending one or more queries to tenant data storage 522 and/or systemdata storage 524. System 516 (e.g., an application server 600 in system516) automatically generates one or more SQL statements (e.g., one ormore SQL queries) that are designed to access the desired information.System data storage 524 may generate query plans to access the requesteddata from the database.

Each database can generally be viewed as a collection of objects, suchas a set of logical tables, containing data fitted into predefinedcategories. A “table” is one representation of a data object, and may beused herein to simplify the conceptual description of objects and customobjects according to the present invention. It should be understood that“table” and “object” may be used interchangeably herein. Each tablegenerally contains one or more data categories logically arranged ascolumns or fields in a viewable schema. Each row or record of a tablecontains an instance of data for each category defined by the fields.For example, a CRM database may include a table that describes acustomer with fields for basic contact information such as name,address, phone number, fax number, etc. Another table might describe apurchase order, including fields for information such as customer,product, sale price, date, etc. In some multi-tenant database systems,standard entity tables might be provided for use by all tenants. For CRMdatabase applications, such standard entities might include tables forAccount, Contact, Lead, and Opportunity data, each containingpre-defined fields It should be understood that the word “entity” mayalso be used interchangeably herein with “object” and “table”.

In some multi-tenant database systems, tenants may be allowed to createand store custom objects, or they may be allowed to customize standardentities or objects, for example by creating custom fields for standardobjects, including custom index fields. U.S. patent application Ser. No.10/817,161, filed Apr. 2, 2004, entitled “CUSTOM ENTITIES AND FIELDS INA MULTI-TENANT DATABASE SYSTEM,” which is hereby incorporated herein byreference, teaches systems and methods for creating custom objects aswell as customizing standard objects in a multi-tenant database system.In certain embodiments, for example, all custom entity data rows arestored in a single multi-tenant physical table, which may containmultiple logical tables per organization. It is transparent to customersthat their multiple “tables” are in fact stored in one large table orthat their data may be stored in the same table as the data of othercustomers.

It should be noted that any of the different embodiments describedherein may or may not be equipped with any one or more of the featuresset forth in one or more of the following published applications:US2003/0233404, titled “OFFLINE SIMULATION OF ONLINE SESSION BETWEENCLIENT AND SERVER,” filed Nov. 4, 2002; US2004/0210909, titled “JAVAOBJECT CACHE SERVER FOR DATABASES,” filed Apr. 17, 2003, now issued U.S.Pat. No. 7,209,929; US2005/0065925, titled “QUERY OPTIMIZATION IN AMULTI-TENANT DATABASE SYSTEM,” filed Sep. 23, 2003; US2005/0223022,titled “CUSTOM ENTITIES AND FIELDS IN A MULTI-TENANT DATABASE SYSTEM,”filed Apr. 2, 2004; US2005/0283478, titled “SOAP-BASED WEB SERVICES IN AMULTI-TENANT DATABASE SYSTEM,” filed Jun. 16, 2004; U52006/0206834,titled “SYSTEMS AND METHODS FOR IMPLEMENTING MULTI-APPLICATION TABS ANDTAB SETS,” filed Mar. 8, 2005; US2008/0010243, titled “METHOD AND SYSTEMFOR PUSHING DATA TO A PLURALITY OF DEVICES IN AN ON-DEMAND SERVICEENVIRONMENT,” filed Jun. 1, 2007; and/or US 2009/0037828 titled “SYSTEM,METHOD AND COMPUTER PROGRAM PRODUCT FOR EDITING AN ON-DEMAND DATABASESERVICE GRAPHICAL USER INTERFACE,” filed Jul. 17, 2008, which are eachincorporated herein by reference in their entirety for all purposes.

While the invention has been described by way of example and in terms ofthe specific embodiments, it is to be understood that the invention isnot limited to the disclosed embodiments. To the contrary, it isintended to cover various modifications and similar arrangements aswould be apparent to those skilled in the art. Therefore, the scope ofthe appended claims should be accorded the broadest interpretation so asto encompass all such modifications and similar arrangements.

1. A method, comprising: receiving, at a first domain, a request from auser to make records accessible; generating a token unique to therequest; tagging the records specified by the request with the token andexecutable computer code to provide access to the records; sending thetoken to the user; receiving, at a second domain, a request to accessthe records, the request including the token; determining whether therecords of the request to access the records includes the token; andpermitting access to at least one record containing the token byexecuting the computer code.
 2. The method of claim 1, wherein therequest to access the records includes a request to download therecords.
 3. The method of claim 1, wherein the token is automaticallygenerated on-demand in response to the receipt of the request to makethe records accessible.
 4. The method of claim I, wherein the tokenincludes a randomly generated identifier.
 5. The method of claim 1,wherein each of the records is further tagged with an identifier of theuser.
 6. The method of claim 1, wherein the first domain of themulti-tenant on-demand database service includes a first server of amulti-tenant on-demand database service and the second domain of themulti-tenant on-demand database service includes a second server of themulti-tenant on-demand database service.
 7. The method of claim 1,wherein the request to access the records is received from a device ofthe user.
 8. The method of claim 1, wherein the token is verifiedutilizing the second domain,
 9. The method of claim 8, wherein access tothe records by the user is prevented in response to a failure of theverification of the token.
 10. The method of claim 18, wherein the tokenincludes a time-to-live and is verified by determining that the token isstored and that the token has not expired.
 11. A computer programproduct e bodied on a non-transitory computer readable medium,comprising: computer code for receiving, at a first domain, a requestfrom a user to make records accessible; computer code for generating atoken unique to the request; computer code for tagging the recordsspecified by the request with the token and executable computer code toprovide access to the records; computer code for sending the token tothe user; computer code for receiving, at a second domain, a request toaccess the records, the request including the token; computer code fordetermining whether the records of the request to access the recordsincludes the token; and computer code for permitting access to at leastone record containing the token by executing the computer code.
 12. Anapparatus, comprising: a first domain including at least one firstprocessor for: receiving a request from a user to make recordsaccessible, generating a token unique to the request, and tagging therecords specified by the request with the token and executable computercode to provide access to the records, sending the token to the user;and a second domain including at least one second processor for:receiving a request to access the records, the request including thetoken, determining whether the records of the request to access therecords includes the token, and permitting access to at least one recordcontaining the token by executing the computer code.